Information
The login keychain is a secure database store for passwords and certificates and is created for each user account on macOS. The system software itself uses keychains for secure storage. Anyone with physical access to an unlocked keychain where the screen is also unlocked can copy all passwords in that keychain. Application access to the login keychain does not keep it unlocked. If you set Apple Mail to check for email every 10 minutes using the keychain for credentials and the keychain to lock every 15 minutes if inactive it will still cause the keychain to lock. The approach recommended here is that the login keychain be set to periodically lock when inactive to reduce the risk of password exposure or unauthorized use of credentials by a third party. The time period that an organization uses will depend on how great the use is of keychain-aware applications. Organizations that use Firefox and Thunderbird will have a much different tolerance than those organizations using keychain aware applications extensively.
Rationale:
While logged in, the keychain does not prompt the user for passwords for various systems and/or programs. This can be exploited by unauthorized users to gain access to password-protected programs and/or systems in the absence of the user. Timing out the keychain can reduce the exploitation window.
Impact:
If the timeout is set too low on heavily-used items the user will be annoyed and may use workarounds.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Perform the following to set the login keychain inactivity time lock:
Graphical Method:
Open Keychain Access
Select login
Select Edit
Select Change Settings for keychain login
Authenticate, if requested.
Change the Lock after # minutes of inactivity setting for the Login Keychain to a value that is <= 6 hour (360 minutes)
Terminal Method:
For each user, run the following command to set the lock value for the login keychain:
$ sudo -u <username> security set-keychain-settings -t 21600 /Users/<username>/Library/Keychains/login.keychain
example:
$ sudo -u seconduser security set-keychain-settings -t 21600 /Users/seconduser/Library/Keychains/login.keychain